Amazon S3 bucket policy为IAM用户配置Deny规则报错无效动作求助

问题根因 #

你当前的Bucket Policy报错是因为操作权限与资源层级不匹配：

• s3:GetObject属于对象级操作，适用的资源格式为 arn:aws:s3:::桶名/*，和你当前写的资源格式匹配
• s3:DeleteBucket属于桶级操作，仅能作用于桶本身的ARN：arn:aws:s3:::桶名，不能作用于对象路径/*下，所以触发了Policy has invalid action报错

修正方案 #

你可以选择以下两种方式调整，按需选择即可：

方案1：拆分两条Statement（逻辑更清晰，推荐）

{
    "Id": "Policy1630065308389",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1630065306314-object",
            "Action": [
                "s3:GetObject"
            ],
            "Effect": "Deny",
            "Resource": "arn:aws:s3:::mybucketv11/*",
            "Principal": {
                "AWS": "arn:aws:iam::673863497215:user/mom-tester"
            }
        },
        {
            "Sid": "Stmt1630065306314-bucket",
            "Action": [
                "s3:DeleteBucket"
            ],
            "Effect": "Deny",
            "Resource": "arn:aws:s3:::mybucketv11",
            "Principal": {
                "AWS": "arn:aws:iam::673863497215:user/mom-tester"
            }
        }
    ]
}

方案2：同一条Statement内补充资源数组

如果不想拆分Statement，也可以直接将Resource字段改为同时包含桶ARN和对象ARN的数组：

{
    "Id": "Policy1630065308389",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1630065306314",
            "Action": [
                "s3:DeleteBucket",
                "s3:GetObject"
            ],
            "Effect": "Deny",
            "Resource": [
                "arn:aws:s3:::mybucketv11",
                "arn:aws:s3:::mybucketv11/*"
            ],
            "Principal": {
                "AWS": "arn:aws:iam::673863497215:user/mom-tester"
            }
        }
    ]
}

内容的提问来源于stack exchange，提问作者chakra t